gcp-run-public-invoker
allUsers/allAuthenticatedUsers bound to run.invoker on a service reachable from the internet.
match (record)
{
"field": "iamPolicy.bindings",
"resource_type": "google.cloud.run.Service"
}
where
a binding grants roles/run.invoker (or run.routes.invoke) to allUsers or allAuthenticatedUsers
ingress setting permits public traffic (ingress=all) OR the Invoker IAM check is disabled
emit
| target type | AnonymousIdentity |
|---|---|
| source | <Cloud Run service> |
| target | <AnonymousIdentity> |
| permissions | run.routes.invoke (allUsers) |
| conditions | network_reachability |
Narrative
Cloud Run service {resource.name} is invokable by anyone on the internet (run.invoker bound to allUsers + public ingress).
Raw rule rules/derived/gcp/cloudrun.yaml
id: gcp-run-public-invoker
emits: ExposedToInternet
description: allUsers/allAuthenticatedUsers bound to run.invoker on a service reachable from the internet.
match_record:
resource_type: google.cloud.run.Service
field: iamPolicy.bindings
where:
- a binding grants roles/run.invoker (or run.routes.invoke) to allUsers or allAuthenticatedUsers
- ingress setting permits public traffic (ingress=all) OR the Invoker IAM check is disabled
emit:
target_type: AnonymousIdentity
source: <Cloud Run service>
target: <AnonymousIdentity>
permissions:
- run.routes.invoke (allUsers)
conditions:
- network_reachability
false_positive_note: "Do NOT flag if ingress=internal or ingress=internal-and-cloud-load-balancing without\
\ a public LB \u2014 the allUsers binding is then not internet-reachable. Requires BOTH the public\
\ invoker binding AND public ingress."
narrative: Cloud Run service {resource.name} is invokable by anyone on the internet (run.invoker bound
to allUsers + public ingress).